[00:00.000 --> 00:05.000]  Good afternoon. My name is Ben Hublin and I'm chairman of the U.S. Election Assistance Commission
[00:05.000 --> 00:11.340]  or EAC. I appreciate the opportunity to speak at this year's Virtual Voting Village.
[00:11.340 --> 00:16.900]  I wish I was able to be there in person. Last year I certainly enjoyed the experience and saw a real
[00:16.900 --> 00:23.020]  step forward in the dialogue and discourse around making our elections more secure. I'll jump into
[00:23.020 --> 00:28.080]  that more in a minute, but for some background I wanted to start by talking about the EAC
[00:28.600 --> 00:36.440]  and what we do. The EAC was established by the Help America Vote Act of 2002, or HAVA,
[00:36.440 --> 00:43.340]  which was Congress's response to the Florida 2000 election. The EAC is an independent bipartisan
[00:43.340 --> 00:50.000]  commission charged with ensuring secure, accurate, and accessible elections by developing guidance
[00:50.000 --> 00:56.100]  to meet HAVA requirements, adopting Voluntary Voting System Guidelines, or the VVSG,
[00:56.100 --> 01:00.960]  and serving as a national clearinghouse of information on election administration.
[01:01.540 --> 01:08.420]  The EAC also accredits testing laboratories and certifies voting systems, as well as administers
[01:08.420 --> 01:15.840]  the use of HAVA funds. We are a small agency, which you might not know by the attention we get.
[01:15.840 --> 01:20.920]  We certainly try to punch above our weight class as an agency with one of the smallest budgets in
[01:20.920 --> 01:26.940]  federal government. But as an agency, we are committed to providing helpful and up-to-date
[01:26.940 --> 01:31.900]  information to promote the continuity and integrity of election administration,
[01:32.140 --> 01:37.120]  despite new challenges such as COVID-19 and cyber interference.
[01:39.840 --> 01:47.160]  In FY20, the EAC received a budgetary increase from our all-time low, and as an agency we focused
[01:47.160 --> 01:53.840]  on investing these precious resources wisely in a way that would help the elections. I'm pleased
[01:53.840 --> 01:59.300]  to be able to tell you today that a number of our new initiatives are already underway and hopefully
[01:59.300 --> 02:05.600]  already making an impact. As part of our efforts, the EAC launched the Cyber Access and Security
[02:05.600 --> 02:13.000]  Program this April to provide access to security training, best practices, expertise, and other
[02:13.000 --> 02:18.280]  assistance for election officials and their IT staff. An important part of this program has been
[02:18.280 --> 02:23.840]  the addition of staff who have a range of experience in the cybersecurity and elections
[02:23.840 --> 02:30.180]  fields, including years of expertise in software development and security analysis. The program
[02:30.180 --> 02:35.480]  partners with public and private security experts with a goal that election officials will have
[02:35.480 --> 02:40.640]  access to the most up-to-date and best-in-class information available through the EAC's Clearing
[02:40.640 --> 02:47.500]  House. One of the Cyber Access and Security Program's first projects was in response to a
[02:47.500 --> 02:52.780]  concern we'd heard from election officials about the volume of cyber expertise and recommendations
[02:52.780 --> 02:57.860]  that were being developed around the election space and how it would be helpful to have an
[02:57.860 --> 03:04.360]  organized repository. The EAC's election security preparedness page is designed to be a one-stop
[03:04.360 --> 03:10.020]  shop for election cybersecurity guidance. It includes resources from federal agencies,
[03:10.020 --> 03:16.880]  nonprofits, academia, and local election officials. These resources include the work of a number
[03:16.880 --> 03:23.360]  of individuals associated with the voting village, so thank you. The page was recently updated with
[03:23.360 --> 03:29.740]  new guidance on security topics that have developed since the 2016 election, and it's been reorganized
[03:29.740 --> 03:35.200]  to make the information easier to find and use. In addition to pulling resources together,
[03:35.200 --> 03:40.640]  we've recognized that many of the great resources that have been produced only realize their full
[03:40.640 --> 03:45.400]  benefit if election officials have a solid foundation to view them from. With that in mind,
[03:45.400 --> 03:51.060]  in June, the EAC announced online cybersecurity training offered at no cost and developed
[03:51.060 --> 03:55.920]  specifically for election officials through a partnership with the Center for Tech and Civic
[03:55.920 --> 04:03.060]  Life, or CTCL. The online training consists of both video and written materials separated into
[04:03.060 --> 04:09.740]  three modules, Cybersecurity 101, 201, and 301. This is self-paced training, and it provides
[04:09.740 --> 04:16.300]  foundational knowledge on cybersecurity terminology, best practices in election offices,
[04:16.300 --> 04:21.700]  practical applications, and communication around cyber incidents. We hope this is a resource that
[04:21.700 --> 04:27.660]  can benefit any local election official and their staff. We've been promoting it to local election
[04:27.660 --> 04:33.080]  officials, and you can too. This is available to every state and local election official in the
[04:33.080 --> 04:40.560]  country at no cost through May of 2021. So far, nearly 200 state and local election officials
[04:40.560 --> 04:45.420]  who are responsible for running elections for millions of voters and their partners have
[04:45.420 --> 04:51.200]  completed this training. We plan to continue to focus on training efforts going forward
[04:51.200 --> 04:56.460]  particularly if our funding trend continues. I would also mention that later this month we're
[04:56.460 --> 05:01.980]  launching both a risk management and a crisis management online workshop for state and local
[05:01.980 --> 05:09.120]  election officials. Along those lines, we'll be hosting a joint effort with CISA, an online
[05:09.120 --> 05:14.600]  risk management tool, allowing election officials at the local level to easily measure and mitigate
[05:14.600 --> 05:21.780]  risks to their specific environments. Finally, our cyber access and security team is updating
[05:21.780 --> 05:27.800]  materials currently posted to the EAC website and is working to develop new material related
[05:27.800 --> 05:33.080]  to vulnerability disclosure programs, social engineering mitigation, and other education
[05:33.080 --> 05:40.800]  efforts. Another area our cyber access and security team has been working on is non-voting
[05:40.800 --> 05:46.580]  election technology. Not the best name, but an area of great importance when it comes to securing
[05:46.580 --> 05:52.220]  our election infrastructure and maintaining public confidence in the electoral process.
[05:52.240 --> 05:58.100]  First and foremost, I think we all recognize that when you look at the cyber risk profile of
[05:58.100 --> 06:04.980]  elections, that non-voting election technology like poll books, election night reporting,
[06:04.980 --> 06:10.540]  and statewide voter registration databases are all potential targets. This is not a secret.
[06:10.540 --> 06:15.440]  Everyone's been talking about this since 2016, and in fact there have been a number of bills
[06:15.440 --> 06:21.020]  introduced in Congress to try to do something about the fact that we don't have standards or
[06:21.400 --> 06:27.560]  a certification program for this type of technology, even though some states do. We know, however, that
[06:27.560 --> 06:33.160]  the nature of these systems don't necessarily lend themselves to a voluntary voting system
[06:33.160 --> 06:40.360]  guideline style certification program. With that mind, the EAC has partnered with the Center for
[06:40.360 --> 06:47.520]  Internet Security, or CIS, and a number of states to pilot a technology verification program focused
[06:47.520 --> 06:52.980]  on non-voting election technology, including, as I mentioned earlier, electronic poll books,
[06:52.980 --> 06:58.680]  election night reporting websites, and electronic ballot delivery systems. This program is called
[06:58.680 --> 07:05.960]  the Rapid Architecture-Based Election Technology Verification, or RABiT-V. It relies on a risk-based
[07:05.960 --> 07:12.040]  approach that allows rapid verification of manufacturers' security claims. The RABiT-V
[07:12.040 --> 07:18.280]  pilot program supports agile software development with a verification process that anticipates and
[07:18.280 --> 07:25.280]  supports rapid product changes. Goals of the pilot program include incentivizing high-quality
[07:25.280 --> 07:31.800]  modern design of IT systems updated in smaller, more manageable cycles that reduce cost of
[07:31.800 --> 07:38.280]  verification and re-verification with more reliable and consistent outcomes for the purchasers of
[07:38.280 --> 07:43.960]  these systems. I'm excited about the prospects of this pilot, but no matter what, I'm confident that
[07:43.960 --> 07:49.640]  we'll learn more about how to think about these technologies and can apply those lessons moving
[07:49.640 --> 07:53.900]  forward. We're committed to expanding the EAC's clearinghouse function
[07:53.900 --> 07:59.950]  to include information and best practices around non-voting election technology.
[08:00.580 --> 08:06.360]  And speaking of voting technology, certainly there's nothing more central to the EAC's mission
[08:06.360 --> 08:13.340]  than the Voluntary Voting System Guidelines. The VVSG are the benchmark for voting system
[08:13.340 --> 08:18.920]  usability and security across the country. Unfortunately, the standard that is primarily
[08:18.920 --> 08:24.540]  used was written over a decade ago and therefore preceded many of the more recent technical
[08:24.540 --> 08:33.480]  innovations that we see in other areas of our lives. The update process for the VVSG is very
[08:33.480 --> 08:40.500]  public and technical. We received over 1,600 unique public comments on the draft principles
[08:40.500 --> 08:46.720]  and guidelines. We heard from industry stakeholders, voting advocates, and members of the public.
[08:46.720 --> 08:52.660]  I'm hopeful that the VVSG 2.0 is on track to be approved by the end of the year.
[08:52.700 --> 08:57.080]  In order to meet that deadline, the EAC is working on several parallel paths
[08:57.080 --> 09:04.020]  addressing the VVSG 2.0 technical requirements, test assertions, the testing and certification
[09:04.020 --> 09:09.960]  program manual, and the voting system test laboratory program manual. So we've got our
[09:09.960 --> 09:15.320]  work cut out for us, but again, we're pushing through on this and we're working on all of
[09:15.320 --> 09:21.480]  these areas right now to try to get it done by the end of the year. Speaking of the end of the
[09:21.480 --> 09:29.600]  year, as we look at the 2020 election, certainly it's important to look back at the 2016 election
[09:29.600 --> 09:36.200]  and where we've come. As I look at the elections community, it's certainly come together and made
[09:36.200 --> 09:44.960]  tremendous progress since 2016 and the first voting village at DEFCON in 2017. The EAC regularly
[09:44.960 --> 09:50.480]  collaborates with partners at the federal, state, and local levels. Earlier you heard from some of
[09:50.480 --> 09:56.980]  those federal partners at NSA, CISA, and FBI. We also work with the National Association of
[09:56.980 --> 10:02.340]  Secretaries of State, National Association of State Election Directors, and local election
[10:02.340 --> 10:09.640]  official organizations to help reach the nearly 9,000 local election officials across the country.
[10:10.120 --> 10:15.640]  Today, election officials are better educated about cyber and physical threats to their systems
[10:15.640 --> 10:21.500]  and have access to resources to better help defend those systems. Manufacturers of voting
[10:21.500 --> 10:26.960]  equipment are also changing their behavior. They are reporting and sharing threat intelligence,
[10:26.960 --> 10:32.480]  opening up to researchers via bug bounty programs, and working with the EAC to issue critical
[10:32.480 --> 10:38.000]  software patches much more quickly. And so certainly, you know, it's hard to think about
[10:38.000 --> 10:45.920]  elections right now without thinking about the upcoming 2020 election and the impact of COVID-19.
[10:45.920 --> 10:52.740]  Certainly that's why this voting village has been done virtually. And COVID-19 is presenting
[10:52.740 --> 10:59.440]  unprecedented challenges around our country. And of course, the election administration community
[10:59.920 --> 11:05.560]  is facing real challenges in determining how to best conduct elections in this environment.
[11:05.560 --> 11:11.300]  At the EAC, we've pivoted substantially to focus our attention on how we can support state and
[11:11.300 --> 11:16.540]  local election officials as they learn from their primaries and make tough decisions about the
[11:16.540 --> 11:24.280]  general election. Between the CARES Act election money and the earlier Consolidated Appropriations
[11:24.280 --> 11:32.580]  Act of 2020, EAC has distributed about $825 million to the states this year to assist with federal
[11:32.580 --> 11:38.300]  elections. And we know this funding will be crucial because of the additional expenses related to
[11:38.300 --> 11:44.660]  running elections during the pandemic. For most jurisdictions, that means running the largest
[11:44.660 --> 11:51.220]  mail or absentee ballot election they've ever run, but also having safe in-person options as well,
[11:51.220 --> 11:56.680]  which means social distancing in the polling places and personal protective equipment being
[11:56.680 --> 12:05.260]  available. And so in ways to address that, we have since April, we've held public hearings.
[12:05.260 --> 12:11.000]  We've also hosted a number of Zoom videos or web chats where we've brought together experts from the
[12:11.000 --> 12:17.620]  elections field to discuss these best practices and lessons learned on unrelevant topics to running
[12:17.620 --> 12:23.700]  an election right now during the pandemic. We've heard about challenges and lessons learned from
[12:23.700 --> 12:30.340]  ramping up vote-by-mail and heard very practical examples and success stories, as well as pitfalls
[12:30.340 --> 12:36.040]  and how to avoid them. Because each state runs elections somewhat differently, each response to
[12:36.040 --> 12:41.600]  this pandemic has been somewhat different. With the changes to the election process,
[12:41.600 --> 12:48.400]  you know, we know that creates an environment that could be taken advantage of for misinformation or
[12:48.400 --> 12:54.540]  disinformation. So certainly that is an area of concern, an area that we need to continue to work
[12:55.240 --> 13:01.940]  on. As you know, we've seen the dates of primaries change, you've seen processes and procedures
[13:01.940 --> 13:08.520]  change. You know, there will be different polling places because some are not available. Maybe they
[13:08.520 --> 13:15.040]  were in somewhere like a senior center that's no longer available. And so efforts like the National
[13:15.040 --> 13:22.220]  Association of Secretaries of State's Trusted Info 2020 effort will be even more crucial.
[13:22.220 --> 13:28.580]  And it is to the degree that folks from the voting village and other communities can help
[13:28.580 --> 13:34.940]  promote state and local election officials as that trusted source, pushing out that information
[13:34.940 --> 13:41.580]  that we know is accurate and helping to combat disinformation is going to be crucial this
[13:41.580 --> 13:49.720]  election year. And speaking of ways for the voting village to help out, you know, we know there's
[13:49.720 --> 13:56.260]  plenty of work to do and more work that needs to be done. Election officials, like I mentioned
[13:56.260 --> 14:02.860]  earlier, absolutely, you know, working around the clock to adapt to the COVID environment
[14:03.490 --> 14:09.570]  certainly can use assistance, as I mentioned before, on misinformation and disinformation.
[14:09.860 --> 14:16.980]  But also, you know, researchers, one way to help is to responsibly engage with election officials
[14:16.980 --> 14:23.060]  and manufacturers. The Cybersecurity and Infrastructure Security Agency, or CISA,
[14:23.060 --> 14:28.960]  recently published a guide to vulnerability reporting for Americans' election administrators.
[14:28.960 --> 14:34.280]  It walks election officials through the steps of establishing a vulnerability disclosure program
[14:34.280 --> 14:39.920]  so that researchers don't end up having their bug reports ignored or having their activities
[14:39.920 --> 14:46.200]  reported to the FBI as hacking attempts. Another way to help this year is to serve as a poll worker
[14:46.200 --> 14:52.120]  and reaching out to your local election official to see if you can sign up. Matt Blaze has promoted
[14:52.120 --> 14:58.740]  this for some time and I certainly appreciate his poll worker recruitment efforts, but this year
[14:59.600 --> 15:04.920]  poll workers are needed more than ever. It's never an easy thing to recruit poll workers, but we've
[15:04.920 --> 15:11.760]  seen a significant dropout with COVID-19. Obviously, in a pandemic, it's a personal decision
[15:11.760 --> 15:18.160]  about serving as a poll worker, but if you're able and willing, that is desperately needed.
[15:18.160 --> 15:25.600]  In fact, the EAC is announcing that September 1st, we're going to push National Poll Worker
[15:25.600 --> 15:30.220]  Recruitment Day this year to try to help election officials around the country
[15:30.880 --> 15:37.120]  get enough poll workers. By encouraging more people to become poll workers in their communities,
[15:37.120 --> 15:42.840]  National Poll Worker Recruitment Day aims to address the critical shortage of poll workers,
[15:42.840 --> 15:49.100]  strengthen our democracy, inspire greater civic engagement and volunteerism, and help ensure free
[15:49.100 --> 15:54.960]  and fair elections in November and beyond. While the specific duties and compensation vary
[15:55.560 --> 16:01.860]  depending on location, poll workers are the face of the election during voting. Most jurisdictions
[16:01.860 --> 16:07.940]  task election workers with setting up and preparing the polling location, welcoming voters,
[16:07.940 --> 16:14.060]  verifying voter registrations, and issuing ballots. Poll workers also help ensure voters
[16:14.060 --> 16:19.920]  understand the voting process by demonstrating how to use voting equipment and explaining voting
[16:19.920 --> 16:25.780]  procedures. Poll workers with technical backgrounds are especially important in jurisdictions where
[16:25.780 --> 16:32.220]  newer voting equipment will be used for the first time, and voters may need a little extra assurance
[16:32.920 --> 16:39.320]  to become comfortable with the new technology. I hope to see you in person at next year's Voting
[16:39.320 --> 16:46.120]  Village. In the meantime, if there are ways the EAC can help or recommendations you have for us,
[16:46.120 --> 16:52.220]  please reach out. Let's keep the conversation going. And again, one last time, if you can do it,
[16:52.220 --> 16:54.900]  please consider serving as a poll worker. Thank you.
